Ethereum presale wallet recovery: unlocking a 2014 genesis wallet

Do not upload your presale JSON to any website. It contains your only key. Every legitimate step below runs on a machine you control. There is no legitimate “presale recovery service” that asks you to send the file or the password to them.

What you actually have

A presale wallet is a JSON file with three fields that matter: encseed (your encrypted seed), ethaddr (your public ETH address), and email. The encryption is AES-CBC with PBKDF2-SHA256 at 2,000 iterations — weak by modern standards, which means realistic password searches are very tractable.

Step 1 — Confirm the file is genuine

1. Open the JSON in a text editor. Confirm it has encseed and ethaddr fields.
2. Paste the ethaddr value into etherscan.io. Confirm there’s a presale-era balance and any airdrops you’d expect (ETC fork, etc.).
3. If the balance is non-zero, you’re holding a real presale wallet — proceed.

Step 2 — If you remember the password

Install Geth on an offline computer and run geth wallet import presale.json. Enter the password, and Geth will import the resulting account into its keystore. From there you can sign a single transaction sending the balance to a fresh address on a hardware wallet.

Step 3 — If the password is forgotten

This is the most common presale case. The right tool is btcrecover (yes, it handles Ethereum presale files too). Build a token file describing what you remember about the password: rough length, languages, dictionaries, capitalization habits, suffixes. Because the KDF is only 2,000 PBKDF2 rounds, a modern GPU tests millions of candidates per second. Realistic searches finish in hours.

Step 4 — If you’ve lost the JSON file

The file was emailed to you after purchase and stored locally by the Mist downloader. Search every backup, every old email account, every external drive. Look for filenames matching ethereum-wallet-*.json, presale.json, or messages from the Ethereum Foundation. On a drive you suspect held the file but no longer shows it, forensic carving can often recover it — even years after deletion — because the file is small and has a recognizable JSON signature.

When this stops being a DIY job

Presale recoveries are some of the highest-value, highest-stakes cases we see. Don’t guess your way through these.

• You have the JSON but the password is mostly forgotten — only fragments remain.
• The JSON is on an old laptop or backup drive that won’t boot.
• You only have the address (from an email or a screenshot) and need to find the original file.
• A previous “recovery service” has the file and is demanding payment to release it.

We work cases like these every month. The combination of disciplined password search, careful disk forensics, and respect for the fact that you only get one shot at this is what separates a successful presale recovery from a lost one. You retain custody of the key throughout. No upfront fees.