₿ datchecker datchecker Before you buy Anatomy Credits GitHub ↗ 9,518 files dissected · 0 recoverable
the 5-minute anti-scam check

Someone is selling you a lost wallet.dat. Here is how it always goes.

The file costs you crypto, the story costs you hope, and the balance was never yours to claim. Before you pay, run this check. It takes five minutes and it is free.

9,518 files dissected 1,219/1,219 encrypted = fabricated 0 recoverable — ever

The check — three steps, five minutes

Do this before money moves, not after. You only need the file the seller sent you.

1

Ask the seller for the SHA-256 of the exact file

One hash, of the exact file they are selling — not a screenshot, not a “similar” one.

Any seller can produce it in seconds: sha256sum wallet.dat on Linux, shasum -a 256 wallet.dat on macOS, certutil -hashfile wallet.dat SHA256 on Windows. If they dodge, stall, or send the hash of a different file, you already have your answer.

2

Paste it into the verifier

The verifier on the front page checks this database locally — the file never leaves your machine.

Open the verifier, drop the file the seller sent you, and compare the hash it computes with the one the seller claimed — if they differ, the file was swapped. The lookup runs against the 1,396 dissected specimens of this database, entirely in your browser. Nothing is uploaded anywhere.

3

Read the verdict

In the database → walk away. Not in the database → manual checklist below.

A hit returns the full autopsy: fabrication class, custom mkey, key birth dates, how many byte-identical copies traveled the pack. A miss proves nothing on its own — the corpus is large but not exhaustive — so finish with the ten signals.

In the database → walk away — you are holding a dissected fake, autopsy included.
Not in the database → that proves nothing yet; finish with the ten signals below.

The 10 signals it is fake

Every one of them is documented in dissected files from the packs. A single one is enough to walk away.

01

It won't open in Bitcoin Core — even with the correct password

The master key uses a layout Bitcoin Core never writes. No password can ever decrypt it.

Core stores the master key as salt[8] + key[32] + iters + method. These files store IV[16] + key[32] + salt[8] + 0 + iters — counterfeiter tooling. Reading that, Core mistakes 48 bytes for the salt and 8 for the key, with zero iterations: decryption is impossible by construction, for any password. The file only “opens” as a cracking hash — which is exactly what the seller attaches. The full layout →

02

It comes with “clues”: .hash files, Password-Hints.txt, a Telegram channel

Genuine lost wallets don't ship with props. The factory always includes them.

The packs bundle Password-Hints.txt, ready-made hashcat hashes, “hint” lists, sometimes even the cracker itself. In this corpus, the hash inside the seller's hint file matches the custom mkey of the wallet bit for bit: hints and wallets come off the same assembly line. A genuine inheritance does not include marketing.

03

The balance is in the folder name: “32'85679_BTC”

That number is the seller's label, not your balance.

Dated packs encode in the folder name the balance a certain address had when the pack was tagged (32'85679 = 32.85679 BTC — verified to the satoshi). The address is real and funded; it also belongs to someone else, and the number was frozen at tagging time. It is a price sticker, not a promise.

04

The dates don't add up: a “2011 wallet” with keys born 2019-2021

Every key carries its birth date in keymeta. The factory can fake labels, not time.

One wallet labeled “13-05-2011” holds ~2,000 keys generated in bursts across 2019–2021 — the last batch on 13-05-2021. Another labeled “10000BTC” grew 2,000 keys in 24 minutes in 2020 using a 1,000-key keypool — a feature that only exists since Core 0.16 (2018). A genuine old wallet can be upgraded by a modern Core; it cannot regenerate its whole keypool ten years later without being rebuilt. The dates →

05

The addresses with balance belong to THIRD PARTIES

Rich-list addresses and 2013-15 pool payouts, copied from the chain. The money is theirs.

The premium trick: take real, funded Bitcoin addresses — mostly P2PK mining-pool payouts from 2013-2015, whose pubkeys are public on the chain — and embed them as defaultkey/ckey in a rebuilt wallet. About 12,332 BTC still sit today on the 319 active addresses embedded in corpus files: it belongs to their original owners, and the pack’s two “whales” were drained years ago. There is no offline way to prove the attached ckey holds that private key. How the bait works →

06

Several “different” wallets share addresses or the same defaultkey

Mass production leaves fingerprints: one factory default key behind most of the “86 valid” wallets.

Most cuda8 wallets share one factory default key (1LV8yhFejYPkZb1MT7pf4Hkvq2LhQ1G4TL — 177 of 235 corpus files), and “different” wallets in the same pack contain identical addresses and keypools. Pairs even share the exact mkey iteration counts — the factory reused parameters between runs. If your one-of-a-kind relic has 85 siblings, it is merchandise.

07

The pack includes the cracker — John the Ripper, pre-cracked

They sell the tool and the hope in the same box.

The packs unpack to 32,191 files in total (11.6 GB); MEGA-BONUS-10k alone ships 9,081 wallet files — bundled with a cracked John the Ripper. A genuine lost wallet does not need a bundled cracker; a challenge file does — the business model is you, spending days brute-forcing a file that no password can open. The tool is not a bonus; it is the hook.

08

“86 valid wallets” and balance lists — none of it is reachable

Lists promising up to 31,000 BTC. Not one of them is reachable: where the money is real, it sits on a third-party address embedded as bait.

The “86 valid wallets” lists (cuda8_86_Valid-WALLETS.txt) advertise balances from 0.19 to 31,000 BTC. Checking the addresses on any explorer shows none of these wallets has ever held its promised balance: where the quoted amount is real, it sits on a third-party bait address embedded in the file — plus dust on the factory key. A wallet with a real balance always has a history of its own; these have a press release. Try the explorer on any address they quote.

09

It isn't even Berkeley DB: base64 blobs dressed as “Electrum”, loose JSON

The “Electrum wallet 19,414 BTC” is a text file. A 23 MB wallet(3).dat is a JSON dump.

Some pack entries skip the Berkeley DB container entirely. The famous “Electrum wallet 19,414 BTC” is a 1.8 MB base64 text blob — nothing like Electrum's real JSON format — and a 23 MB wallet(3).dat is loose JSON with an addr_history: a dump, not a wallet. The pack invoices every format a buyer might recognize by name. The impostors →

10

Urgency pressure, or sale via Telegram/forums with no reputation

“Last copy.” “Price doubles tonight.” No escrow, no history, no recourse.

Countdown pressure, crypto-only payment, channels created last month, “sold to someone else if you don't decide now.” The technical signals above are decisive on their own — the ritual is what the same trick looks like from the outside. Real wallets do not expire tonight, and honest sellers do not fear a five-minute check.

“But my seller says…”

Four excuses that arrive right on schedule — and what the file itself says.

“The password is in the hints — try it yourself, it works.”

Try it: even with the correct password the wallet will not decrypt, because the master key is written in a layout Core cannot read. The hints are the trick, not the proof.

“It's from 2011 — of course modern Core can't open it.”

Old wallets open fine in modern Core — it upgrades them. But no upgrade regenerates the whole keypool with 2020-2021 birth dates. The dates are inside the file.

“Check the explorer — the balance is right there.”

The address is real, and so is the balance — it belongs to a 2013-15 mining-pool payout or a rich-list holder. A public pubkey copied from the chain is not a private key.

“The file is clean — I scanned it, no virus.”

VirusTotal hunts malware, not fabrication. A fake wallet.dat is not a virus: it is marketing. “Clean” only proves it won't infect you — it never promised to open.

Five minutes. Zero uploads. Then decide.

Is your file not in the database but shows these signals? Report it on GitHub — this database grows from reports. GitHub issues →