How much crypto is lost — and how much is forgotten passwords?

How much Bitcoin is permanently lost?

The most-cited estimate comes from Chainalysis, first published in 2017. Chainalysis segmented the Bitcoin supply by coin age and transaction activity and estimated how much was likely permanently out of circulation. Its 2017 analysis estimated that roughly 2.78–3.79 million BTC was effectively gone — commonly quoted as ~3.7 million BTC, about 17–23% of the circulating supply at the time.¹ At late-2017 prices that was roughly $32 billion; at recent prices the same coins would be worth several hundred billion.

Two things are worth noting about that headline number. First, it predates the 2021 and 2024 bull runs, and the supply has since grown — but no newer study has revised the share dramatically. Second, and more important: forgotten passwords are only one slice of it.

Why these numbers are estimates — and why that matters

No analyst can see a wallet and know why its coins never move. The estimate captures the combined result of everything that permanently removes coins from circulation:

• wallets whose passwords and seed phrases were forgotten or misplaced;
• hardware wallets and USB drives that failed or were destroyed;
• owners who died without passing on their access;
• paper wallets lost, damaged, or thrown away;
• coins deliberately burned, or stuck on dead exchanges and services.

The conclusion: the true “forgotten password” figure is lower than the total lost-Bitcoin figure, but there is no reliable way to split it out. What the cases below show is that the forgotten-password slice alone is large enough to matter — three documented incidents alone account for roughly 16,200 BTC.

Three documented cases that made the numbers real

These are the cases with enough public documentation to verify: the amounts, the circumstances, and the sources. They are why this problem gets covered by mainstream media — and they are all preventable in hindsight.

Stefan Thomas — 7,002 BTC, two guesses left on an IronKey

In 2011 Stefan Thomas, a German-born programmer, was paid 7,002 BTC for making an animated video explaining Bitcoin. He stored the private keys on an IronKey USB drive, which wipes itself permanently after 10 incorrect password attempts. He wrote the password down on paper, lost the paper, and by the time BBC reported the story in January 2021 he had used 8 of his 10 attempts — two guesses remained for a holding worth roughly $240 million at the time.² He publicly decided to keep trying to remember rather than risk attempt nine. The drive has never been unlocked.

Why it matters for you: hardware that erases itself after a limited number of tries changes the strategy completely — guessing becomes risky, not just slow. Some hardware wallets impose retry limits, delays or device-reset behaviour after repeated incorrect PIN attempts; the exact behaviour is device-specific, so check the manufacturer’s documentation before guessing.

James Howells — 7,500 BTC thrown out with a bin bag

In the summer of 2013, IT engineer James Howells of Newport, Wales, threw away a hard drive containing the private keys to 7,500 BTC. His partner had mistakenly put the bag in the rubbish; it went to the Docksway landfill. At the time the coins were worth roughly £500,000; by the December 2024 High Court hearing over his bid to excavate the site, the same stash was worth over £500 million.³ Newport City Council has repeatedly refused permission to dig, citing environmental permits. In January 2025, the High Court dismissed the claim, effectively ending that legal route. The coins remain in the ground, unreachable.

Why it matters for you: “I know exactly where it is” is not the same as “I can get to it.” The first thing to do after a password loss is secure every remaining copy of the wallet file — before it follows the bin bag.

The 1,700 BTC German police cannot unlock

In February 2021, prosecutors in Kempten, Bavaria announced they had seized 1,700 BTC (then worth about $60 million) from a convicted fraudster who had used victims’ computers for mining. The password problem: the man refused to hand it over, and the wallet’s encryption was robust enough that German law enforcement could not break it.⁴ The coins have sat locked in state custody since.

Why it matters for you: if a state prosecutor’s office with real technical resources cannot crack a properly encrypted wallet without the password, neither can anyone who emails you a quote. Anyone who claims instant success against modern encryption is not telling you the truth.

What surveys say about everyday access loss

Lost-Bitcoin studies measure the extreme tail. Surveys measure the everyday version. Kaspersky’s Crypto Threats 2023 report — a survey of 2,000 American adults conducted in October 2022 — found that 32% of people who own or have owned crypto said they had lost access to a crypto-related account at some point.⁵ The same survey found only 15% used a cold wallet and only 34% used two-factor authentication — which is exactly the behaviour profile that produces forgotten wallet passwords.

The practical takeaway: if you’re reading this because you locked yourself out, you are not in a rare category. Roughly one in three people who have ever held crypto has been where you are. That’s why this site exists, and why the systematic search — not panic — is the statistically correct first move.

Why the same password gets harder to crack every year

The second force behind the headlines is that wallet encryption has been getting stronger on purpose. The number of key-derivation iterations determines how many guesses a computer can try per second — and wallets have been ratcheting that number up for a decade. These are the verified parameters, taken from the format specifications and from measurements published by the open-source recovery tool btcrecover:

Iteration counts for wallet.dat are dynamic — the wallet picks a count based on the machine that encrypted it — so real wallets vary; the figures shown are the values measured on the reference wallets in the btcrecover benchmark suite. Ethereum keystores: 262,144 is the current geth default for both scrypt and PBKDF2; older wallets created by early tools used lower values, which is one reason an old keystore can be far easier to crack.

Read that table once more, because it explains the entire industry: a modern wallet.dat lets a cracker try only a few hundred guesses per second, and an Ethereum scrypt keystore only around a hundred. Older files are often faster to test — old wallet.dat files frequently have fewer rounds (the exact count is stored in the file), and some early Ethereum keystores used very low KDF costs — which is why an old wallet can be dramatically easier. That is why “when is recovery possible” has a real, technical answer — and why the answer keeps changing with your wallet’s age.

What the numbers mean for your own wallet

• An old wallet is your best luck. Older wallet.dat files often have fewer key-derivation rounds, especially if they were encrypted on slower hardware — but the exact round count is stored in the wallet and is not determined by the year alone, so identify the file and read the stored parameters before estimating cracking speed. The same password that would take centuries to crack in a high-round wallet may be reachable in a low-round one. Identify your file first.
• You are one of ~32%, not a freak case. Losing access is statistically normal. The recovery path is methodical search, not shame and panic.
• Know the numbers before you pay anyone anything. If the math on your case says no, that is the real answer — and knowing it protects you from anyone who promises otherwise.
• Prevention beats every statistic. The prevention guide is short — and it is the one page worth reading before you ever need it.

Sources

1. Chainalysis lost-Bitcoin estimate, reported by Fortune, “Lost Bitcoins: Research estimates up to 3.79 million Bitcoins are gone forever” (Nov 2017) — fortune.com/2017/11/25/lost-bitcoins
2. BBC News, “Man has two guesses to unlock bitcoin worth $240m” (Jan 2021) — bbc.com/news/technology-55645408
3. The Guardian, “Man has ’finely tuned’ plan to find £500m bitcoin thrown in tip, Cardiff court told” (Dec 2024) — theguardian.com (Dec 3, 2024)
4. Reuters, “Police seize $60 million of bitcoin! Now, where’s the password?” (Feb 2021); also covered by Ars Technica — reuters.com (Feb 5, 2021)
5. Kaspersky, “Crypto Threats 2023” survey of 2,000 U.S. adults (Oct 2022), released Mar 2023 — prnewswire.com (Mar 22, 2023)
6. Bitcoin Core’s wallet encryption uses a dynamic rounds count chosen by the encrypting machine — the mechanism is documented on the Bitcoin Wiki’s wallet-encryption technical page — en.bitcoin.it/wiki/Wallet_encryption. The ~25,000-round baseline for old wallets comes from Bitcoin Core’s own crypter code (DEFAULT_DERIVE_ITERATIONS); the exact count in any wallet was chosen at encryption time based on machine speed, and the btcrecover reference wallets measure 67,908–267,488 rounds (source 7).
7. BTCRecover, “Performance Benchmarks” — measured passwords-per-second and wallet iteration counts on reference hardware (Ryzen 9 9950X, RTX 5090), published on the project’s readthedocs — btcrecover.readthedocs.io/Benchmarks
8. Ethereum Foundation, “Web3 Secret Storage Definition” — official KDF test vectors (PBKDF2 c=262,144; scrypt n=262,144 r=8 p=1) — ethereum.org/docs (Web3 secret storage)
9. BIP-0038, “Passphrase-protected private key” — scrypt parameters n=16384, r=8, p=8 — github.com/bitcoin/bips (BIP-0038)

Compiled and checked 6 August 2026. All source URLs verified live at the time of writing. Where the original sources report ranges (as Chainalysis does), this page reproduces the range rather than inventing a single number.