找回那些
本该消失的资产。 We bring back
what was supposed to vanish.

一部 2014 年的 iPhone 因连续错误密码进入永久停用状态。硬件团队通过 BootROM 漏洞获取原始映像，定位了钱包数据库与加密版本，结合客户线索完成爆破。第 41 天资产回到新冷钱包。

A 2014-era iPhone in permanent disable state. The hardware team imaged the device via a BootROM exploit, located the wallet databases, and targeted the password using fragments the client could recall. Day 41, assets moved to a fresh cold wallet.

2013 年存入的一笔 BTC，密码遗忘。前期六个月规则攻击未命中。内部口令推导引擎升级后，新模式覆盖了客户当年的"两段拼接"习惯，第十一个月完成爆破。

A 2013 BTC deposit, password forgotten. Six months of standard rule attacks landed nothing. After an internal upgrade adding two-segment concatenation patterns the client had used, the password broke in month eleven.

2018 年世界杯决赛之夜，客户在醉酒后给钱包设了一组约 15–16 位的密码。次日醒来彻底无法复现，仅记得"大概混了几个数字和符号"。

After the 2018 World Cup final, the client set a ~15–16 character password on a wallet while drunk. The next morning it was gone. The only fragment they could give us was "some numbers and symbols, probably."

由于搜索空间巨大、客户线索几乎为零，案件进入冷案队列。三个月后内部口令推导引擎升级，新增对"键盘临近键漂移"与"重复双字符"模式的覆盖，最终命中。

With a massive search space and almost no leads, the case sat in the cold queue. Three months later our password-derivation engine added patterns for adjacent-key drift and repeated digrams — and the password broke.

设备外壳烧蚀，PCB 焊点受损，常规启动失败。委托人持有该钱包多年，已无法回忆助记词；资产同时涉及 BTC 与 ETH。

Burn damage on the shell, broken PCB joints, refused to boot. The client had owned the wallet for years and no longer recalled the seed; assets included both BTC and ETH.

硬件实验室对主控芯片进行去封装后从非编程区直接读取，配合该机型已发表的安全研究恢复种子。第 22 天完成全部交付。

In the lab we decapsulated the main controller and read the unprogrammed region directly, combining the dump with published security research on the model to reconstruct the seed. Day 22, end-to-end.