4 or 5 Words Missing — Tier 3 No-Find-No-Fee Recovery

In one paragraph. If you have a BIP-39 seed phrase with one or two words missing, the recovery is mostly arithmetic and your wallet will likely be back in your hands within an hour or two. With three missing words it becomes harder but is still well within reach. With four or five missing words you are in a different country: the search space jumps from millions to trillions to quadrillions of candidates, no laptop CPU on earth will finish the problem in a useful time, and the work moves to a GPU farm running for days or weeks. This is what Arcana calls a Tier 3 engagement. It is the only tier we price on a no-find-no-fee basis. This guide explains why it works that way, what the maths actually says, what the GPU deposit covers, and the honest odds of success.

1. Why four words is not just "two more than two"

A recurring conversation we have with prospective clients goes like this. "I have seven words. So I'm missing five. You said one word was no problem; five must be five times harder, right?"

This is the single most important misconception to clear up before we talk about anything else, because it shapes every other decision — the price, the timeline, the technical approach, the realistic odds, the engagement structure.

A single missing BIP-39 word means we must try every word in the BIP-39 wordlist at that position until one produces the target address. The BIP-39 English wordlist contains 2,048 words. Worst case: 2,048 attempts. On a modern laptop that is a fraction of a second.

Two missing words means we must try every combination of two words from the wordlist. 2,048 × 2,048 = 4,194,304 — about four million combinations. A laptop CPU finishes this in seconds to a few minutes.

Three missing words is 2,048³ = 8.6 billion combinations. A multi-core laptop CPU finishes in minutes to a couple of hours depending on the optimisation. Still well within reach.

Four missing words is 2,048⁴ = 17.6 trillion combinations. Five is 2,048⁵ = 36 quadrillion combinations. We have crossed the boundary where CPU-only search is no longer viable in any practical timeframe. The work has to move to GPU, has to be planned around days or weeks of compute, and has to be commercially structured around uncertain success.

The numbers do not increase linearly. Every additional missing word multiplies the previous search space by 2,048. The technical and commercial implications of that exponential are the entire reason a separate Tier exists.

When the positions of the missing words are also unknown — for example, when a paper backup has fading in multiple places and we cannot tell which specific words are missing versus which are merely hard to read — the combinatorics multiply again, by the number of position-permutations. For a 24-word phrase with 5 unknown positions, C(24,5) = 42,504 position combinations. Multiply that into the 36 quadrillion word combinations and you get a number that, even on the most aggressive GPU setup, is months of compute. Some cases at that frontier are simply not commercially recoverable; we will tell you so at scoping.

This is also why a client offering us a list of candidate words helps enormously. If you can tell us "I know the phrase contained some combination of the following 18 words" — or "the missing words almost certainly include some of forest, mountain, river, valley" — we can collapse the search space dramatically. We will ask for this at scoping.

2. The maths in slightly more detail (skip this section if you want)

For readers who want the technical reasoning rather than just the table.

A BIP-39 seed phrase is generated as follows. The wallet generates 128, 160, 192, 224, or 256 bits of cryptographic randomness (entropy). It appends a checksum derived from a SHA-256 hash of that entropy. It then partitions the resulting bit string into 11-bit chunks. Each chunk is looked up in the BIP-39 wordlist (which contains exactly 2¹¹ = 2,048 words) and the corresponding word is written out. The result is a 12-word phrase (128 bits + 4-bit checksum), 18-word (192 + 6), or 24-word (256 + 8).

There is a subtle but practically important consequence of the checksum: not every random sequence of 12 BIP-39 words is a valid phrase. Roughly 1 in 16 of all possible 12-word combinations passes the checksum (because the last 4 bits of the last word encode the checksum, leaving 7 bits free out of the 11 bits of that word's index). For 24-word phrases the checksum is 8 bits and only 1 in 256 random combinations is valid. This is why a fast recovery tool spends most of its time discarding candidate phrases at the checksum step, before ever bothering to derive an address.

For a Tier 3 search with 4 missing words and known positions, the effective search space — once invalid checksums are discarded — is 17.6 trillion / 16 ≈ 1.1 trillion candidate phrases that could be valid. For each of those we must then derive at least one address (the Client's target) and compare. Address derivation involves BIP-32 hierarchical-deterministic derivation, SHA-256 + RIPEMD-160 hashing, and base58 encoding. On a modern high-end GPU, optimised address derivation sustains on the order of a billion candidate evaluations per second.

Doing the arithmetic: 1.1 trillion candidates ÷ 1 billion keys/second = ≈ 1,100 seconds of pure compute, or about 18 minutes. That is the theoretical minimum. In practice, GPU memory transfer, the cost of the checksum filter, restart overheads, and the fact that the actual speed is closer to 100-300 million effective candidate-phrases per second (after all overheads) means the real runtime for a 4-word-missing case with known positions is typically 6-72 hours on a single high-end GPU. Five missing words is two to three orders of magnitude longer.

We share the maths openly because the alternative — quoting a single-day timeline and then quietly running for two weeks — is the pattern used by less honest firms, and the disappointment is worse than a realistic estimate at the start. If the maths in this section is not your kind of reading, the takeaway is just: 6-72 hours for a normal 4-word case, weeks or longer for hard 5-word cases.

3. What changes when we move to GPU

The technical jump from CPU-based search (Tier 1 and Tier 2) to GPU-based search (Tier 3) is not just about speed. Three things change.

The hardware. A typical CPU on a modern laptop or workstation has 8-16 cores; each core does general-purpose work and can manage perhaps a few hundred thousand BIP-39 candidate evaluations per second after the checksum filter. A high-end consumer GPU has thousands of parallel cores; each core is dramatically simpler than a CPU core but, run in parallel on a task perfectly suited to it (and seed recovery is exactly such a task), produces on the order of a billion candidate evaluations per second. That is a factor of roughly 3,000-5,000× the CPU.

The software. CPU recovery uses general, flexible tools — including our own Suite's native Seed Recovery module — that work on almost any wallet format and run in Python with NumPy and multiprocessing. GPU recovery uses specialised GPU-accelerated tooling and its CUDA kernels — these are narrower in scope, written in low-level CUDA C, and only handle a specific subset of recovery problems (primarily BIP-39 mnemonic search and certain key-range searches). The narrower scope is the price for the speed.

The cost structure. A laptop running for an hour costs pennies in electricity. A GPU rig under sustained 350-watt load running for two weeks consumes about 117 kWh, which at UK industrial electricity prices is around £30-50 in electricity alone, and that ignores capital depreciation of the GPU itself (a £1,500 card has a useful life measured in years and is amortised across engagements). At the Tier 3 level, GPU electricity and amortisation become non-trivial line items in the engagement economics. This is one of the reasons the GPU deposit exists (§6 below).

4. Accelerated search — the general picture

You do not need to know the internals of our GPU tooling to engage us. This section is for the curious and for the technically literate readers who want to confirm we understand the problem before parting with money.

GPU-accelerated search applies the same cryptographic primitives that secure Bitcoin — elliptic-curve point multiplication, SHA-256, RIPEMD-160, base58 encoding — to deriving addresses from very large numbers of candidate seed phrases in parallel. Where a CPU evaluates candidates more or less a batch at a time, a GPU evaluates thousands simultaneously, which is why a problem that is hopeless on a laptop becomes tractable on the right hardware.

Our recovery workstation is an airgapped tower (see §6 of our Inherited Wallet Recovery guide for the procedural discipline) running a high-end consumer GPU, with a second card retained for non-overlapping search-space partitioning when an engagement justifies parallelism. We keep the exact tooling and hardware configuration internal — not for secrecy's own sake, but because those specifics are operational detail that belongs in our internal procedures, not on a public page.

We do not run cloud GPU instances for seed recovery. Cloud GPU is convenient for less sensitive workloads but for Tier 3 seed recovery it creates two problems that are unacceptable on our service: (a) the seed material (even in its position-skeleton form) would have to traverse a network we do not control, breaking the airgap discipline; (b) the cost model becomes per-hour rather than per-engagement, which creates the wrong incentive (a cloud-running firm benefits from a slow search). We absorb the capital cost of the GPU rig and recover it through Tier 3 engagement economics.

For the technically literate reader: yes, in principle a dedicated ASIC or FPGA could outperform a GPU on this workload, and there are research-grade implementations that demonstrate this. The economics do not currently justify ASIC investment for the volumes a small specialist firm sees. If that changes — for instance, if scope changes and we begin handling enterprise-scale recovery — the rig will evolve.

5. The no-find-no-fee model — why it works this way

Most professional services charge for the work, not the outcome. A solicitor's hourly rate applies whether the case is won or lost. A surveyor's fee applies whether the house is bought. A doctor is paid whether the treatment succeeds.

Recovery work has an unusual property: the technical outcome is highly bimodal. Either the seed is recovered and the wallet is back in the client's hands — which, in cases where the wallet contains meaningful value, transforms the client's financial position — or it is not, in which case the engagement has produced no recoverable value at all.

Charging the full Tier 3 fee for a no-find outcome would, in fairness, be charging for work that did not produce the outcome the client engaged us for. It is reasonable to reject that on principle, and we agree with the principle. Equally, charging nothing for a no-find outcome would mean running a GPU rig for weeks at our expense with no contribution from the client to the electricity, the wear on the hardware, or the opportunity cost — which means we could not sustain the service at the prices we currently quote, and we would have to either raise prices generally or restrict Tier 3 to a narrow set of pre-vetted high-probability cases.

The model we have designed is:

• A refundable GPU deposit at engagement, which covers (with a defined cap) the actual electricity and amortisation cost of the GPU search.
• A Tier 3 fee charged on success, which is fixed in advance and visible in the engagement letter — not a percentage of recovered value.
• No claim on recovered value beyond the Tier 3 fee. If we recover a wallet containing £400 or £400,000, the fee is the same. Percentage-of-recovery pricing creates the wrong incentives (we cover this point in detail in §7 of our Inherited Wallet Recovery guide — it applies identically here).

The deposit is honest, the success fee is fixed, and the firm's incentive aligns with finishing the search efficiently — not with running the GPU for an indefinite period. We think this is the only structure that does not contain a hidden conflict of interest.

6. The GPU deposit explained

This is the section most people want clarity on, so we are explicit.

6.1 What the deposit is

The GPU deposit is a sum paid at engagement, held by Arcana, that secures the GPU rig for the agreed time budget. The deposit amount is calculated at scoping based on:

• The estimated GPU-hours required for the search (from the combinatorics — see §2 above — adjusted for the actual position pattern of your case).
• The energy cost per GPU-hour at current UK industrial electricity rates (we use a published rate snapshot from the engagement-letter date).
• A hardware amortisation contribution.
• A modest contingency for runtime variance.

In a typical 4-word case with known positions, the deposit is in the £400-£900 range. In a hard 5-word case it can be £1,200-£2,500. The figure is in the engagement letter before you sign.

6.2 What happens to the deposit at the four possible outcomes

• Match found within agreed time budget. The deposit is converted into part of the Tier 3 success fee. The fee remaining (success fee minus deposit) is invoiced and payable on receipt. You end up paying the Tier 3 fee in total — not the deposit and the fee.
• No match within agreed time budget, no extension requested. The deposit is refunded net of actual GPU electricity cost, capped at the deposit amount. In practice this typically returns 30-70% of the deposit to the client, depending on how much of the time budget actually ran. The Forensic Report and Destruction Certificate are still issued (see §6 of our Inherited Wallet Recovery guide for the chain-of-custody discipline). The cap is the protection — your downside is the deposit, no more.
• No match within agreed time budget, extension agreed. A short addendum to the engagement letter sets a new time budget and a top-up deposit. The previous deposit converts toward the extended electricity cost. Some 5-word cases recover only on a second or third extension; some are abandoned at the end of the first; we have no preference and discuss it openly.
• Client withdraws mid-engagement. The deposit is refunded net of GPU cost incurred up to the moment of withdrawal. You may withdraw at any time without contractual penalty beyond the GPU cost.

The four-way deposit handling is one of the items the engagement letter spells out in detail. If the wording is unclear, ask before signing — we will not start the search until the engagement letter is countersigned.

6.3 Why this is not "just take a fee for the work"

Because the work, in this kind of search, is hardware time. The fee we earn beyond the GPU-time cost is the success fee — that is, the Tier 3 fixed fee for the technical scoping, the airgapped workflow, the chain-of-custody, and the encrypted delivery. The success fee is contingent on a match because that is where the engagement's commercial value to the client lies. The GPU-time cost is contingent only on time elapsed and is what the deposit covers. The two pieces are separated deliberately. A firm offering "Tier 3 no-find-no-fee, zero deposit" is either taking the GPU cost out of a different revenue stream (which they will need to be honest about) or is structurally unsustainable — neither outcome is good for you.

7. Realistic odds — when this works, when it doesn't

We will not quote a single percentage success rate. The success rate depends on the specific case, and a single number across all Tier 3 work would mislead.

The predictive factors are:

Factors that make a Tier 3 case likely to succeed:

• The missing word positions are known (you know it is positions 7, 12, 18, and 22 that are gone — not "somewhere in the middle").
• The target Bitcoin address is known and verifiable (a transaction confirmation email, a screenshot, an on-chain address you visited recently). Without a known target we cannot verify a match.
• The wallet is on a standard derivation path (BIP-44 for Legacy BTC, BIP-49 for SegWit, BIP-84 for Native SegWit). Non-standard paths are recoverable (we have a Tier 2 service for them — see Funds Not Showing? Derivation Paths Explained) but they extend the Tier 3 search if combined with missing words.
• The wallet does not also have a BIP-39 passphrase ("25th word") that is unknown. If it does, the search problem is multiplied by the passphrase space and is often infeasible — see BIP39 Passphrase (25th Word) Recovery.
• The seed phrase is a single known length (12 or 24 words) rather than ambiguous between the two.

Factors that make a Tier 3 case harder or infeasible:

• Missing word positions are unknown — adds 100× to 50,000× more candidates.
• No target address; only "I think I had some Bitcoin in this wallet around 2014".
• Combined with an unknown passphrase.
• Combined with a non-standard derivation path that you cannot remember.
• Five missing words, in any combination of the above.

In honest practical terms: a 4-word case with known positions, a known target address, no passphrase, and a standard derivation path is, by the mathematics, the most recoverable shape of Tier 3 case — a genuinely strong chance of recovery within a sensible time budget. A 5-word case combining several of the complications above is genuinely difficult, and there are cases where we will advise you not to proceed at all — because once we work through the expected value of the engagement together, the honest answer for you is that it is negative.

Scoping calls are where we tell you, openly, which end of the spectrum your case is on. We will not take a Tier 3 engagement we believe is unlikely to recover within the agreed time budget — not because we cannot make money on it (we would still keep the GPU electricity contribution) but because it ends with a client who is out a deposit and has nothing to show for it, and that is not a service we want to provide.

8. What you need to send us at scoping

To produce an honest quote we need:

1. The known words of the seed phrase, in the positions you know them. Use ? or ___ for missing words. Total length 12, 18, or 24 — tell us which.
2. The Bitcoin (or other coin) address that was associated with this wallet. Even one address from a transaction-history email or screenshot is enough.
3. What you remember about the wallet software — Electrum, Bitcoin Core, Trezor, Ledger, BlueWallet, MetaMask (if it is an ETH-derived seed), etc. This determines the derivation path search.
4. Whether there was a passphrase. Many wallets did not use one — they were optional. If you are unsure, tell us "unsure" rather than guessing.
5. A rough date when the wallet was set up. Older wallets (pre-2017) sometimes used non-standard derivation paths; this informs scoping.

You can send all of this in a plain encrypted email to legal@arcana-crypto.com using our published PGP key (link in the site footer), or on a Signal channel after the initial scoping call. We do not need it on first contact — first contact can be a one-paragraph email saying "I have a 4-word missing case, when can we talk?" and we will reply with a scoping-call slot.

9. What NOT to do

Some of these are repeats from our other guides (intentionally — Tier 3 attracts the most aggressive scams because the cases involve the largest amounts):

• Do not pay a "no recovery, no fee, no deposit" firm. As explained in §6.3, this structure is sustainable only if the firm is either operating dishonestly or subsidising losses out of a hidden revenue stream. The two firms in this space we know of in detail (we did the due diligence after multiple clients asked) are both running covert percentage-of-recovery arrangements — clients sign one contract, the firm produces another at delivery.
• Do not pay for "preliminary analysis" before an engagement letter. A scoping call is free everywhere it is done properly. Any firm charging £200-500 for a "wallet inspection" before quoting is monetising the scoping itself, because the actual job will not happen — there is no actual job.
• Do not share the seed material (even the partial phrase) with anyone before you have a written engagement letter, an identifiable firm, and a verifiable address. Once the partial phrase is out, an unscrupulous recipient can run the missing-word search themselves and quietly take the wallet.
• Do not pay in cryptocurrency. Reputable UK firms invoice in GBP, accept bank transfer or card, and issue VAT-bearing invoices. Crypto-only payment is a tell.
• Do not respond to inbound contact from anyone claiming to "know about" your wallet, your missing words, your old hardware wallet. Almost always a scam pattern targeting people who have publicly discussed their loss (forums, Reddit, YouTube comments).
• Do not let urgency drive the engagement. "Bitcoin is going up, we need to recover now or you lose value" is a sales tactic, not a technical reality. Your wallet will be there in three months as it is today; the technical work runs at its own honest pace. A firm pressing urgency is selling, not engineering.

10. Frequently asked questions

How long does a Tier 3 engagement take from first contact to outcome? Scoping call within a week. Engagement letter and deposit within a further week. GPU search 1-4 weeks of compute on typical cases, longer for harder ones. Delivery and Destruction Certificate within 72 hours of recovery confirmation. End-to-end: typically 4-8 weeks for normal 4-word cases; 8-16 weeks for harder 5-word cases.

Can you run multiple search strategies in parallel? Yes, on partitioned search spaces. For example, if the missing words are at positions 5, 11, 18, 22, we can split the 17.6 trillion search across two GPUs by partitioning on the high bits of position 5. This effectively halves the wall-clock time. We discuss the parallelism strategy in the engagement letter where it applies.

What if the wallet is actually empty? We run the search to its agreed budget regardless. If we recover the seed and the wallet turns out to be empty (the funds were moved away years ago, the wallet was decoy, etc.), the recovery is still technically a success — we deliver the recovered seed material and charge the Tier 3 success fee. You receive the asset you engaged us to recover (the seed), even if the asset's current value is zero. This is uncommon, since most people have some on-chain evidence of activity before engaging.

Does the wallet's age affect feasibility? Mostly through the derivation path question. Pre-2017 wallets sometimes used unusual derivation paths and may need the Derivation Paths workstream layered on top of the Tier 3 search. Pre-2014 wallets sometimes used brain-wallet schemes that are not BIP-39 at all and need an entirely different approach. Tell us at scoping when you set the wallet up and we will route correctly.

Can my solicitor or accountant attend the engagement? Not literally during the GPU search — the workstation is airgapped and we do not allow remote-observation channels (security discipline, not preference). They can review the engagement letter, see the scoping report, attend the encrypted-delivery handover, and receive the signed Forensic Report at the end. Where a third-party witness is specifically required (high-value engagements, family disputes), we can arrange a structured witness procedure at additional cost.

What stops you from finding the seed and then keeping the wallet for yourselves? The forensic chain of custody, the engagement letter, the airgap discipline that prevents network exfiltration during the search, the encrypted-delivery handover to your nominated address, and the legal exposure of doing what you describe (which is fraud and theft, both of which carry custodial sentences and would end the firm). We also carry professional indemnity and cyber insurance with Hiscox; the policy is conditional on us not doing exactly the thing you are asking about, so even our insurer's incentives are aligned with yours. The honest answer is that there is no perfect cryptographic protection here against a firm acting in bad faith — what you have is a combination of professional reputation, regulatory exposure, insurance, and the firm's track record. Verify each of those before engaging; we publish enough to make that verification possible.

What jurisdictions do you serve? UK, EU, and most other jurisdictions where we can complete sanctions and money-laundering checks. We do not currently engage clients resident in the United States or Canada — a regulatory choice. If you are unsure whether your jurisdiction is supported, ask at first contact.

Is the Tier 3 fee VAT-able? Yes, when the client is a UK individual or business; VAT is added at the prevailing rate. EU clients may be invoiced under reverse-charge rules where applicable. Non-EU clients are typically outside the scope of UK VAT. The engagement letter sets out the VAT treatment for your specific case.

Can I get a fixed quote without sending you the partial seed? You can get a quote band (e.g., "£X to £Y" for a 4-word case in your shape) without sending the partial seed. To narrow the band to a single number we need at least the position pattern of the missing words and the target address. We do not require the known words themselves until the engagement letter is countersigned. This is partly to protect you — we are aware that the scoping conversation itself can be a phishing vector if abused.

What happens if the recovery is partially successful — e.g., we find 3 of 4 missing words but not the 4th? Practically, that is not how the search works. The search either produces a complete candidate phrase that derives to your target address (success) or it does not (no-find). There is no "75% recovered" intermediate state. The closest analogue would be a case where the search reveals that one of the missing-word candidates is highly probable but cannot be confirmed without the others — and even there, the absence of a complete match means the wallet remains locked. Tier 3 is binary in its technical outcome.

11. Working with us

Tier 3 engagements are the engagements where being deliberate matters most — the deposit is real money, the timelines are real weeks, and the emotional stakes for clients are usually higher than at Tier 1. We try to slow this down rather than speed it up.

Step one is a written first contact: an email to legal@arcana-crypto.com with a paragraph or two describing your case in plain English. You do not need to share seed material in the first email. We will reply within one working day with a scoping-call slot, typically within the same week.

Step two is the scoping call (free, 45 minutes, by Signal or by encrypted Zoom). We walk through your case, the maths, the deposit, the time budget, the realistic odds. You ask anything. We tell you whether to proceed, and at what indicative cost.

Step three is the written engagement letter — typically issued within 24 hours of the scoping call. You countersign, pay the deposit, and we book the GPU rig.

Step four is the search. You receive a weekly written progress update (no seed data, just runtime metrics and milestone status). The search runs to the agreed budget.

Step five is the outcome — match or no-match — and the corresponding handling per §6.

If, at any point in steps 1-3, the engagement feels uncertain or rushed, slow it down. We would rather not engage a case than engage a case where the client is making the decision under pressure. Tier 3 is patient work.

12. Tier 3 engagement lifecycle — diagram

The full engagement-to-outcome flow, with the four outcome paths from §6:

The diagram shows the no-find-no-fee structure visually. The three gates at the top (scoping decision) keep us from accepting engagements unlikely to recover. The four outcomes at the bottom (match / no-match / extension / refund) make every possible end-state explicit before you sign.

A closing note. Tier 3 recovery is the loudest part of our work — the cases involve the largest amounts, the longest engagements, and the highest stakes for everyone involved. We have tried to write this guide in a way that lets you decide not to engage us, if your case is one of the marginal ones. That is the right test for whether the guide is honest: if reading it makes you more likely to decline a marginal engagement, then we have written it correctly. If anything here is unclear, write to us — legal@arcana-crypto.com — and we will answer.

Arcana Crypto LTD — registered in England and Wales (no. 16371124). Recovery and forensics for cryptoasset wallet-loss cases. UK + EU engagements. Sole Director: R. Macri.

Guide version 1.0.1 · Published 28 May 2026 · Last reviewed 31 May 2026 · Reviewed by counsel. This guide is general information, not legal or financial advice. The engagement letter is the operative contract for any Tier 3 engagement, and its specific terms — not this guide — govern the relationship.